Borrowing it
Nothing to install: this file belongs to rbah31/claude-code-workflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rbah31/claude-code-workflow/main/.claude/settings.jsongit clone --depth 1 https://github.com/rbah31/claude-code-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/hooks/rbah31/claude-code-workflow/pre-tool-use)<a href="https://agentmods.dev/hooks/rbah31/claude-code-workflow/pre-tool-use"><img src="https://agentmods.dev/badge/hooks/rbah31/claude-code-workflow/pre-tool-use/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/hooks/rbah31/claude-code-workflow/pre-tool-use"><img src="https://agentmods.dev/badge/hooks/rbah31/claude-code-workflow/pre-tool-use.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade D, and why
PreToolUse scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the commands this hook runs, not an audit. A hook is shell that executes on your machine at the event it names, which is why every command in it is printed with what was found.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
"command": "CMD=$(python3 -c \"import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))\" 2>/dev/null); for PATTERN in 'rm -rf /' 'rm -rf ~' 'git push --force' 'git push -f' 'git reset --hard' Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"command": "CMD=$(python3 -c \"import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))\" 2>/dev/null); for PATTERN in 'rm -rf /' 'rm -rf ~' 'git push --force' 'git push -f' 'git reset --hard' What it actually says
{
"PreToolUse": [
{
"matcher": "Write|Edit",
"hooks": [
{
"type": "command",
"command": "FILE=$(python3 -c \"import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('file_path',''))\" 2>/dev/null); case \"$FILE\" in /etc/*|/usr/*|/var/*|/System/*|$HOME/.ssh/*|$HOME/.aws/*) echo \"BLOCKED: write outside project directory\" && exit 1;; esac; exit 0"
},
{
"type": "command",
"command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block_wiki_write.py\""
}
]
},
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "CMD=$(python3 -c \"import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))\" 2>/dev/null); for PATTERN in 'rm -rf /' 'rm -rf ~' 'git push --force' 'git push -f' 'git reset --hard' 'chmod 777' 'mkfs' 'dd if=' 'shutdown' 'reboot'; do echo \"$CMD\" | grep -qF \"$PATTERN\" && echo \"BLOCKED: $PATTERN detected\" && exit 1; done; exit 0"
},
{
"type": "command",
"command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-uncommitted-hook.py\""
}
]
}
]
}What else settings.json configures
This page is one entry in a file that holds 5. Installing the file brings all of them; each is measured and scanned on its own page.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 30 lines scan D 229cc30db008
PreToolUse is a hook published in the GitHub repository rbah31/claude-code-workflow (5 stars, last pushed 4mo ago), licensed Apache-2.0. Its token cost is not measured: a hook is shell that never enters the context. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other hooks, from other repositories
SessionEnd
Runs when a session ends, executing session-end-telemetry.sh via bash. From kenspc/kenspc-claude-plugin.
SessionStart
Runs when a session starts on startup, executing install_pkgs.sh. From supabase/supabase.
PostToolUse
Runs after a tool call finishes for Write and Edit tool calls, executing format_and_lint.sh. From supabase/supabase.
SessionStart
Runs when a session starts, executing on-start.js via node. From google-gemini/gemini-cli.
PreToolUse
Runs before the agent uses a tool for Bash tool calls, running an inline shell check. From apache/superset.
PreToolUse
Runs before the agent uses a tool, executing pre-write.sh and pre-bash.sh (2 commands). From anthropics/claude-cookbooks.